feat: add package for go compiler given binary detection (#2195)

adds a unique synthetic package to the SBOM output that represents the go compiler when it is detected as a part of a package discovered by the go binary cataloger.

When using an SBOM generated by syft - downstream vulnerability scanners now have the opportunity to detect/report on the PURL/CPEs attached to the new stdlib package.
---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

test/integration/go_compiler_detection_test.go

@@ -0,0 +1,62 @@
+package integration
+
+import (
+	"testing"
+
+	"github.com/anchore/syft/syft/cpe"
+	"github.com/anchore/syft/syft/source"
+)
+
+func TestGolangCompilerDetection(t *testing.T) {
+	tests := []struct {
+		name              string
+		image             string
+		expectedCompilers []string
+		expectedCPE       []cpe.CPE
+		expectedPURL      []string
+	}{
+		{
+			name:              "syft can detect a single golang compiler given the golang base image",
+			image:             "image-golang-compiler",
+			expectedCompilers: []string{"go1.18.10"},
+			expectedCPE:       []cpe.CPE{cpe.Must("cpe:2.3:a:golang:go:1.18.10:-:*:*:*:*:*:*")},
+			expectedPURL:      []string{"pkg:golang/stdlib@1.18.10"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sbom, _ := catalogFixtureImage(t, tt.image, source.SquashedScope, nil)
+			packages := sbom.Artifacts.Packages.PackagesByName("stdlib")
+
+			foundCompilerVersions := make(map[string]struct{})
+			foundCPE := make(map[cpe.CPE]struct{})
+			foundPURL := make(map[string]struct{})
+
+			for _, pkg := range packages {
+				foundCompilerVersions[pkg.Version] = struct{}{}
+				foundPURL[pkg.PURL] = struct{}{}
+				for _, cpe := range pkg.CPEs {
+					foundCPE[cpe] = struct{}{}
+				}
+			}
+
+			for _, expectedCompiler := range tt.expectedCompilers {
+				if _, ok := foundCompilerVersions[expectedCompiler]; !ok {
+					t.Fatalf("expected %s version; not found in found compilers: %v", expectedCompiler, foundCompilerVersions)
+				}
+			}
+
+			for _, expectedPURL := range tt.expectedPURL {
+				if _, ok := foundPURL[expectedPURL]; !ok {
+					t.Fatalf("expected %s purl; not found in found purl: %v", expectedPURL, expectedPURLs)
+				}
+			}
+
+			for _, expectedCPE := range tt.expectedCPE {
+				if _, ok := foundCPE[expectedCPE]; !ok {
+					t.Fatalf("expected %s version; not found in found cpe: %v", expectedCPE, expectedCPE)
+				}
+			}
+		})
+	}
+}

test/integration/regression_go_bin_scanner_arch_test.go

@@ -10,9 +10,9 @@ import (
 
 func TestRegressionGoArchDiscovery(t *testing.T) {
 	const (
-		expectedELFPkg   = 4
-		expectedWINPkg   = 4
-		expectedMACOSPkg = 4
+		expectedELFPkg   = 5
+		expectedWINPkg   = 5
+		expectedMACOSPkg = 5
 	)
 	// This is a regression test to make sure the way we detect go binary packages
 	// stays consistent and reproducible as the tool chain evolves

test/integration/test-fixtures/image-golang-compiler/Dockerfile

@@ -0,0 +1 @@
+FROM golang:1.18.10-alpine